levelsio spent a day running Claude Code security audits
He wants one week a month set aside for security the way some founders set aside a week for marketing.
levelsio says he spent all day typing one prompt into Claude Code, "Do a full security audit of this website and server", and ran it against every single VPS and site he owns.
Do a full security audit of this website and server
That sat on top of defenses he already had. Automatic unattended upgrades with auto reboot for Ubuntu security updates, which he says costs a four minute reboot every few weeks. Permission work isolating web services to www-data so they do not run as root. And each VPS isolated on Tailscale with security policies that Claude Code itself generated, so a hacked box cannot reach any other VPS, his MacBook or his iPhone unless he talks to it first.
It follows the earlier lockdown he posted, and it is the same instinct taken wider. His own verdict on the work is flat. "Not the most fun stuff but essential."
Security week, every month
The idea he is floating is a calendar one. He suggests that alongside @yongfook's "marketing week" founders now need one week per month of "security week", on the logic that as models get better, pre-emptive defense has to get better too. His comfort, and he hedges it himself, is that attack and defense capability in AI models seem to roughly match, so regularly typing "do a security audit" into a coding agent may be enough to keep things safe. He ends the post with "I hope" and a nervous face.
The prompt is worth copying, but the Tailscale piece is the part that does the real work. An audit finds what it finds. Network isolation decides how much one missed thing costs you when a box goes down.
Why the urgency is not theoretical
Dominik Sobe ツ posted the other half of this story the same week. He says one of his companies was hit by an AI cyber attack unlike anything he had seen, that he got it under control, and that patching on the spot was stressful enough that he still felt the aftermath physically a week later. He also says it happened before the wider chaos he refers to as Black October, and that none of that chaos surprised him.
One founder's audit routine is not a benchmark, and nobody in these posts is claiming a measured reduction in risk. What you have is a solo operator with a lot of servers deciding the defense budget is now one day of prompting plus policies written by the same tool he builds with, and another founder who found out the hard way why he bothered.
One of my companies has been AI cyber attacked unlike anything I've ever seen before.
Steal the numbers, not the vibes
One email a day. Under three minutes. Real MRR, real pricing, real launches from founders building with AI.